Determine what this plan is used for (e.g., a computer breech, a network breech, tracing e-mails, computer fraud, hacking a system, etc.).

Create a list of at least 1015 steps that should be followed in the investigation.

Discuss the following, and then determine which of the following each individual team member will be responsible for:

Describe the types of data that should be uncovered in the investigation.

Detail the types of forensics tools that can be used to uncover the data.

Discuss how that data is to be handled (i.e., collection, identification, transportation, storage, documenting the investigation, and chain of custody.

Discuss warrants and privacy rights.

Add a conclusion that discusses a plan to share your investigation with law enforcement.